Hermes Agent vs ZeroClaw

Hermes Agent

Card payments always ask first and are refused in unattended sessions, and the messaging gateway denies every sender until an allowlist is set. Shell commands run on the host by default with a model judging risk, and sending mail through the Google Workspace skill is held back only by an instruction to the model.

ZeroClaw

Supervised autonomy is the default, so tools outside a short read-only list wait for the owner's approval, and secrets are encrypted in the config file. The docs state that command execution is not written to an audit log, and the project publishes no privacy policy or terms.

Hermes Agent

1. Set approvals.mode: manual before giving it real accounts. The default smart lets an auxiliary model approve commands
2. Run the gateway with terminal.backend: docker or the project's Docker image when it reads mail, web pages or group chats
3. Set memory.write_approval: true and skills.write_approval: true to review what it saves about the owner
4. Leave approvals.cron_mode and approvals.unattended_mode at deny for scheduled and webhook runs
5. Set TELEGRAM_ALLOWED_USERS or the matching allowlist per channel. Never set GATEWAY_ALLOW_ALL_USERS=true

ZeroClaw

1. Keep [risk_profiles.<alias>] level = "supervised". full runs every tool not listed in always_ask, and the YOLO preset removes the sandbox and path rules too
2. Add sending and account tools such as send_via, google_workspace and http_request to always_ask so a session-level Always grant cannot skip the prompt
3. List senders in [peer_groups.<name>] external_peers. ["*"] accepts anyone on that channel
4. Set [web_fetch].allowed_domains and [http_request].allowed_domains. Fetches run unprompted and the OS sandbox does not block egress
5. Run one-shot tasks with zeroclaw agent -a <alias> -m "<task>". A cron or webhook turn has no prompt, so shell calls fall to the command policy